# Defense in depth: if this folder ever ends up inside a web-accessible
# directory by mistake, block direct access entirely. The real protection
# is deploying app/ and database/ OUTSIDE public_html — see README.md.
Require all denied
